Bioc rules (XQL query)

[Ajhuge]

Hello everyone. I need help about bioc rules. I found a lot of ioc rules from other source. But I dont know how can I change that ioc rules to BIOC rules. Thats really so big problem for me and I can't figure out. Who can help me about that? Thanks in advance.

[aleksandar.astardzhiev]

Hi @Ajhuge ,

Can you please clarify what are you trying to achieve?

I am probably missing your point, but IOC and BIOC are two different thinks:

- IOC are "static" indicator like known bad IP, domain, file hash, file name etc. XDR allow you to manually add IOC one at time, or bulk import from file. Working with IOCs • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documentation p...

- BIOC are behavior indicator, where using XQL query you can define what behaviors/actions/series of related actions could be suspicious. Working with BIOCs • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documentation ...

You don't need to create BIOC to look for IOC. XDR will raise alert whenever defined IOC is detected.

If you want to import IOC from external Threat Intelligence, unfortunately XDR doesn't support "polling" IOC from external source. However you can "push" IOC to XDR using the Rest API - as mentioned in above links this option is available only for Pro per Endpoint license

[TamikaGunter]

Thanks for the links, and if I still face any issue, I will message you.